I believe it's [search] stanza that would make it to work $SPLUNK_HOME/etc/system/local/limits.conf [search] min_settings_period = 60 ... View more

yannK mentioned the following an index named "summary" is shipped with splunk by default ($SPLUNK_HOME/var/lib/splunk/summary/db) I believe it's $SPLUNK_HOME/var/lib/splunk/summarydb, not $SPLUNK_HOME/var/lib/splunk/summary/db. Notice that there is no backslash between "summary" and "db". ... View more

I know that this was posted quite a long time ago, but I am sure that this works in 5.0.3 inputs.conf without "no_priority_stripping" [udp://45515] sourcetype = syslog connection_host = ip index = custom_orig running the search " ./splunk search "index=custom_orig | eval T=_time | convert ctime(T) | eval IT=_indextime | eval R=_raw | sort IT | table T sourcetype host R | sort by sourcetype"", I got T sourcetype host R ------------------- ------------ ------------ ------------------------------------------------- 06/13/2013 19:57:53 kinda-syslog 10.160.44.71 Jun 13 19:57:53 10.160.44.71 ERROR login failure inputs.conf with "no_priority_stripping = true" [udp://45515] sourcetype = syslog connection_host = ip index = custom_orig no_priority_stripping = true running the search "./splunk search "index=custom_orig | eval T=_time | convert ctime(T) | eval IT=_indextime | eval R=_raw | sort IT | table T sourcetype host R | sort by sourcetype"", I got T sourcetype host R ------------------- ---------- ------------ ------------------------ 06/13/2013 20:00:47 syslog 10.160.44.71 <13> ERROR login failure this should work, try it out ... View more

it only provides parameter for sourcetype, not source http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitornetworkports ... View more

In 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3. For example: ./splunk add monitor /var/log/case1 -index test_case1 -check-index false The default behavior is different depending on the version 4.3.3 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.4 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.5 universal forwarder: default check-index is true, which means that it would always check whether the index exists 5.0.2 universal forwarder: default check-index is false ... View more

In 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3. For example: ./splunk add monitor /var/log/case1 -index test_case1 -check-index false The default behavior is different depending on the version 4.3.3 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.4 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.5 universal forwarder: default check-index is true, which means that it would always check whether the index exists 5.0.2 universal forwarder: default check-index is false ... View more

This is problematic in 4.3.2 as you mentioned, but in 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3. For example: ./splunk add monitor /var/log/case1 -index test_case1 -check-index false The default behavior is different depending on the version 4.3.3 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.4 universal forwarder: default check-index is true, which means that it would always check whether the index exists 4.3.5 universal forwarder: default check-index is true, which means that it would always check whether the index exists 5.0.2 universal forwarder: default check-index is false ... View more

This feature "includeZero=false" was indeed broken, and now it seems to be fixed. However, there is a twist to this. Setting charting.chart.axisY.includeZero will have no effect, and the correct property is now charting.axisY.includeZero In other words, instead of using <param name="charting.chart.axisY.includeZero">False</param> Now, you need to use <param name="charting.axisY.includeZero">False</param> With this fix, our charts can look prettier than ever before. ... View more